AI Regulation in the European Union

Guidelines on Transparency Obligations for Providers and Deployers of Certain AI Systems

The European Commission published these guidelines to help providers and deployers of AI systems comply with the transparency obligations established under the EU AI Act, which apply from 2 August 2026. They cover labeling requirements, user notices, logging practices, technical documentation, and internal approval workflows for AI-generated or AI-assisted content. Organizations that develop or deploy AI systems in the EU must follow this guidance to meet their legal obligations under the AI Act.

EU Action Plan on Cybersecurity and Artificial Intelligence

The European Commission's Action Plan on Cybersecurity and Artificial Intelligence establishes a coordinated approach to securing AI systems deployed across the EU. It applies to developers and deployers of AI models subject to the EU AI Act, particularly those operating advanced or high-risk systems. The plan creates dedicated evaluation infrastructure, including a secure testing platform and an EU-level evaluation capability for advanced AI models.

Regulation (EU) 2026/1744 – AI Act Amendment Deferring High-Risk Obligations

Regulation (EU) 2026/1744 amends the EU AI Act by deferring certain compliance deadlines for high-risk AI systems while preserving the 2 August 2026 applicability date for transparency obligations. It applies to enterprises that develop, deploy, or place high-risk AI systems on the EU market. Organizations must now distinguish between obligations that have been deferred and those that remain active on the original schedule.

EU AI Act: AI Literacy and Prohibited AI Systems Provisions (Applicable 2 February 2026)

The EU AI Act's first major compliance deadline takes effect on 2 February 2026, requiring all organizations that develop or deploy AI within the EU to establish AI literacy measures for their workforce. As of this date, the Act's prohibitions on AI systems deemed to pose unacceptable risks also become enforceable. Organizations must have ceased operation of any prohibited AI practices and demonstrated adequate staff competency with AI systems by this date.

EU AI Liability Directive

A proposed EU directive that would have adapted civil liability rules to apply to AI systems, enabling individuals harmed by AI to obtain compensation by lowering evidentiary burdens through disclosure and causation presumptions. The proposal was formally withdrawn in early 2025 following failure to reach political agreement.

EU AI Office Framework

The institutional and regulatory framework establishing the European AI Office as the central EU body responsible for supervising general-purpose AI models, enforcing the EU AI Act at the supranational level, and coordinating AI governance across EU member states.

Code of Practice on Transparency of AI-Generated Content

The European Commission published this voluntary Code of Practice to support compliance with Article 50 of the EU AI Act, which mandates transparency obligations for AI-generated content. It applies to providers and deployers of generative AI systems operating in the EU market. The Code establishes practical standards for content labeling, provenance controls, and disclosure workflows.

EU Cyber Resilience Act

The EU Cyber Resilience Act establishes mandatory cybersecurity requirements for products with digital elements placed on the EU market, including hardware and software incorporating AI components, covering the entire product lifecycle from design through end-of-life.

EU Data Act

The EU Data Act establishes harmonised rules on access to and use of data generated by connected products and related services across the EU, addressing both personal and non-personal data. It creates new obligations for data holders to share data with users and third parties, and sets conditions for public sector bodies to access privately held data in exceptional circumstances.

EU Data Governance Act

The EU Data Governance Act establishes a regulatory framework for data intermediaries, data altruism organisations, and the re-use of public sector data protected by third-party rights. It creates new governance structures to facilitate trusted data sharing across sectors and member states, supporting the broader European Data Strategy.

Proposal for a Regulation for the Digital Networks Act (DNA)

The Digital Networks Act is a legislative proposal introduced by the European Commission on January 21, 2026, addressing digital infrastructure and aspects of AI governance within the European Union. It is currently subject to co-legislative review and negotiation by the European Parliament and the Council of the EU. The proposal is expected to impose obligations on entities operating or deploying digital network infrastructure, including those integrating AI-driven network management systems.

EU Digital Operational Resilience Act

The EU Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, establishes a comprehensive ICT risk management, incident reporting, operational resilience testing, and third-party risk oversight framework for EU financial entities, with direct implications for AI systems deployed in financial services and the technology providers that supply them.

EU Digital Services Act – AI and Algorithmic Accountability Provisions

The Digital Services Act imposes transparency, accountability, and risk-management obligations on online intermediaries with respect to algorithmic recommender systems, targeted advertising, and systemic risks. Obligations scale with platform size, with the most stringent requirements applying to VLOPs and VLOSEs.

EU General-Purpose AI Model Training Data Public Summary Template

The European Commission published a standardized template for providers of general-purpose AI models to use when publicly disclosing summaries of their training data. It supports compliance with the transparency obligations for general-purpose AI models established under the EU AI Act. Providers are expected to follow the template structure when meeting their disclosure requirements under that regulation.